CVE-2026-46854

unknowncovered by 1 sourcefirst seen 2026-06-17

Oracle has fixed multiple vulnerabilities in Oracle Enterprise Manager versions 13.5 and 24.1. The vulnerabilities in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 allow an attacker with low or no privileges and network access via HTTP or HTTPS to gain full control over the platform. Some vulnerabilities do not require authentication and can lead to unauthorized data modification, denial-of-service, or complete system compromise. Additionally, an attacker with SSH access can also achieve full system compromise. The vulnerabilities may also impact other Oracle products that are integrated with the platform. Furthermore, there is a vulnerability in Apache Log4j's JsonTemplateLayout up to version 2.25.3 that generates incorrect JSON output when serializing non-finite floating-point values, which can disrupt downstream log processing systems when MapMessages are logged.

CSIRTS triage

What: Vulnerabilities allow an attacker to gain full control over the platform, potentially without authentication.
Who is affected: Deployments of Oracle Enterprise Manager versions 13.5 and 24.1.
Urgency: Remediation is critical due to the risk of complete system compromise.
Action: Update to the latest versions of Oracle Enterprise Manager.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-46854

Get an email if CVE-2026-46854 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.41% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.

Advisory coverage (1)

unknownNCSC-2026-0202 [1.00] [M/H] Vulnerabilities fixed in Oracle Enterprise Managerncsc-nl · 2026-06-17

External references

NVD record for CVE-2026-46854

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-46854 status](https://www.csirts.com/badge/CVE-2026-46854)](https://www.csirts.com/cve/CVE-2026-46854)